Build More,
Architect Dreams

Azure Container Apps POC — the Referral Service migration to GovCloud

ACA vs AKS · Portal · DAPR · Revisions · Blue/green · Demo runbook

← Back to home · or press → to begin

ACA learning objectives

Platform decision and day-2 operations for .NET on Azure Container Apps — without standing up AKS.

01

Defend ACA vs AKS

Use the decision matrix, POC topology, and docs/ACA-vs-AKS.md.

02

Teach from the Portal

Overview, environment, Dapr components, revisions, log stream.

03

Explain DAPR on ACA

Native sidecar, Service Bus publish, no cluster add-ons.

04

Run blue/green with revisions

Traffic weights, revision lifecycle, CLI demo on Referral Service.

Managed platform vs cluster ops Revision-based deploys GovCloud-ready patterns

Install & Use BMAD

Set up BMAD in your IDE, run the agent commands, and walk through a live story cycle — from install to deployable code.

Works with Cursor, Claude Code, and VS Code + GitHub Copilot

Why this POC exists

A platform proof for enterprise modernization on Azure Government — not full program delivery.

Business needModular Referral Service APIs for enterprise modernization on Azure Government

Platform questionProve .NET on Azure Container Apps with an honest ACA vs AKS comparison

Team readiness.NET and Angular are mature; container modularization guidance is still forming

DAPR commitmentNotifications and logging via DAPR — ACA runs it natively without cluster add-ons

Scope focus: Presentation stays on Angular / COMPASS; SOA Policy Manager unchanged — POC deep-dives Referral API compute and data path.

What this POC proves

In scope

This POC

Referral Service on ACA (.NET 10, EF Core, SQL)
DAPR + Azure Service Bus pattern
Bicep IaC, revisions, health probes
ACA vs AKS decision record
BMAD brownfield delivery + Story 1.2 demo

Backlog

Out of scope

All services containerized (User Profile, AI Orchestration, …)
Full MSMQ replacement without adapter
Production blue/green cutover
AKS as default platform
Live full greenfield PRD in training

Platform stack — Referral Service focus

Domain	Direction for this POC
Presentation	Angular via COMPASS — reuse shared UI components
API edge	SOA Policy Manager — JWT, rate limit, OpenAPI (unchanged)
Compute	Referral Service on ACA — .NET 10 modular APIs
Runtime	DAPR — notifications, shared logging cross-cutting
Data	Azure SQL (EF Core), Redis cache — reuse established estate patterns where possible
Messaging	Azure Service Bus (target); MSMQ adapter interim where required
Security / ops	Front Door + WAF, Key Vault + MI, App Insights — GovCloud gaps noted
IaC / CI	Bicep modules, Azure DevSecOps patterns — partial in POC

Referral Service on Azure Container Apps

Goal: Modular container POC for Azure Government modernization programs

Stack: .NET 10, DAPR, Service Bus, EF Core, SQL, Bicep, ACA revisions

Question answered: ACA vs AKS for .NET microservices with DAPR already committed

BMAD role: Brownfield backfill; Story 1.2 SQL persistence via story cycle

Repo paths: src/ReferralService · infra/main.bicep · _bmad-output/

Why ACA for this platform

Dimension	Azure Container Apps	AKS
DAPR	Built-in, one flag	Helm chart lifecycle
Service Bus scaling	Native KEDA rule in Bicep	Install / configure KEDA
Blue/green	Revisions + traffic split	Argo / Flagger / mesh
Operations	No node pools	Cluster + add-on ops
When AKS wins	Start on ACA first	GPU pools · strict CNI / Calico policy · advanced mesh

Operate & teach ACA

Use the live Portal and this repo to explain revisions, DAPR, and blue/green — without standing up AKS.

Audience: architects & engineers evaluating ACA for enterprise .NET workloads · Duration: ~60 min hands-on demo or Session 2 supplement

What the Portal Overview tab shows

The Overview page is the map of one Container App — not the whole environment.

Essentials field	What it means for teaching
Application Url	External ingress FQDN — hit `/health/live` and `/health/ready` in the demo
Environment	Shared ACA environment — DAPR components and networking live here (click through)
Provisioning state	Resource healthy vs Azure still applying Bicep/ARM changes
Revision (running)	Current image + config snapshot receiving traffic — e.g. `referral-svc-dev--0000006`
Revisions with issues	Failed deploy attempts — image pull, probe failure, bad env — still listed until deactivated
Tags	Cost / ownership — tie to Bicep `tags` in `infra/main.bicep`

Portal → Container Apps → your app → OverviewContrast with Environment overview (shared plane)

Mental model — three layers

1. Container App — your .NET container + optional DAPR sidecar (one revision = one deploy unit)

2. ACA Environment — shared runtime; DAPR components (Service Bus pub/sub) attach here

3. Azure services — Service Bus, SQL, Key Vault, ACR, App Insights — wired via Bicep + MI

Walk left-to-right: ingress → app → DAPR sidecar → Service Bus · SQL via MI · secrets from Key Vault

Revisions — the ACA deploy unit

On AKS you think Pods and Deployments; on ACA you think revisions and traffic weights.

Concept

What is a revision?

01
New deploy = new revisionaz containerapp update or new image
02
Immutable snapshotImage, env vars, scale rules, probes
03
Multiple modeactiveRevisionsMode: Multiple enables traffic split
04
Single modeOne active revision — simpler, no blue/green

Portal

Revisions blade

A
ActiveCan receive traffic
F
FailedProbes or startup failed — no traffic
D
DeactivatedRetired; hidden from default list
%
Traffic column% per revision (100% = one revision live)

Teaching line: No cluster objects to explain — revisions + weights replace Deployments + progressive delivery tooling.

Where DAPR lives (Portal + repo)

Location	Portal path	Repo path
1. App DAPR settings	Container App → Settings → Dapr — enable sidecar, `appId`, port	`infra/modules/containerapp.bicep` — `dapr.enabled`, `appId` must match component scope
2. DAPR components	ACA Environment → Dapr components — pub/sub, state, bindings	`infra/modules/dapr-component.bicep` — `pubsub-servicebus` → Service Bus
3. Application code	Not in Portal — uses DAPR HTTP/gRPC on sidecar	`src/ReferralService/Program.cs` — publish via DAPR client after `POST /referrals`

Common lab error: sidecar log pubsub pubsub-servicebus is not found → appId mismatch or component not on environment.

Blue/green on ACA (no Argo, no mesh)

Five steps — revision traffic weights replace progressive delivery tooling.

1 · BlueCurrent revision100% traffic (e.g. --0000006)

2 · GreenDeploy new imageNew revision at 0% in multi mode

3 · ValidateTest greenRevision URL or small traffic %

4 · ShiftTraffic splitPortal or CLI below

5 · RetireDeactivate blueAfter green is stable

ACA	AKS equivalent (for contrast)
Revision + traffic %	Second Deployment + Service weights or Flagger
Built into platform	Install/configure progressive delivery tooling
Bicep: `activeRevisionsMode`	Helm values + ingress controller rules

CLI — blue/green traffic shift

# List revisions and traffic
az containerapp revision list -n referral-svc-dev -g rg-referral-poc-centralus \
  -o table

# Deploy green (new image) — creates new revision
az containerapp update -n referral-svc-dev -g rg-referral-poc-centralus \
  --image <acr>.azurecr.io/referral-svc:<new-tag>

# Split traffic 90/10 then 100/0
az containerapp ingress traffic set -n referral-svc-dev -g rg-referral-poc-centralus \
  --revision-weight referral-svc-dev--0000006=90 referral-svc-dev--0000007=10

az containerapp ingress traffic set -n referral-svc-dev -g rg-referral-poc-centralus \
  --revision-weight referral-svc-dev--0000007=100

# Deactivate old revision
az containerapp revision deactivate -n referral-svc-dev -g rg-referral-poc-centralus \
  --revision referral-svc-dev--0000006

Run after health probes pass on greenReplace names with your RG and revision IDs

60-minute ACA teach script

Segment	Time	Do this
1 · Why ACA	10 min	POC slides ACA vs AKS + `docs/ACA-vs-AKS.md` — DAPR, KEDA, revisions
2 · Repo walk	15 min	`infra/main.bicep` → modules → `Program.cs` health + DAPR publish
3 · Portal	15 min	Overview → Environment → Dapr components → Revisions → Log stream
4 · Live API	10 min	`/health/live`, `/health/ready`, `POST /referrals` (Service Bus)
5 · Blue/green	10 min	Revision list → traffic split CLI → deactivate old revision

Maps to Session 2 in docs/bmad-facilitator-runbook.md and POC deck slides (topology, decision matrix).

Portal blades — what to open live

Facilitator crib sheet — environment-level DAPR is the #1 concept trainees miss.

App

Container App

Overview — URL, revision, environment
Revisions — traffic %, failed vs active
Settings → Dapr — sidecar + appId
Log stream — app + dapr containers
Env variables — Key Vault refs

Environment

ACA Environment

Dapr components — pubsub-servicebus
Networking — internal vs external
All apps in env — multi-app future

Azure

Supporting services

Service Bus — referral events
SQL — Query Editor + MI grant
Key Vault — ACA secret refs
ACR — image tags for green deploy

ACA vs AKS — demo talking points

When trainees ask…	ACA answer	AKS note (honest)
“Where is DAPR?”	Toggle + component in Bicep; sidecar injected	Helm chart, upgrades, node compatibility
“How do we scale on queue depth?”	KEDA rule on Service Bus (Bicep)	Install KEDA, CRDs, scrape config
“How do we do blue/green?”	Revisions + traffic weights (ACA ops section)	Flagger/Argo or duplicate Deployments
“What about GovCloud?”	Same ACA model; this POC targets Azure Government	AKS also in Gov; more ops surface
“When must we use AKS?”	GPU workloads, strict CNI policy, service mesh at scale — see full matrix in `docs/ACA-vs-AKS.md`

Lab prep & known gaps

Check	Action
Health endpoints	`GET /health/live` and `/health/ready` return 200 before demo
DAPR publish	Verify `appId` = component scope; environment has `pubsub-servicebus`
SQL persistence	Run `scripts/grant-sql-mi-access.sql` in Portal Query Editor; redeploy restores KV secret
Failed revisions	Deactivate old failures so Overview is clean
Commercial vs Gov	No Gov sub? Deploy to commercial (e.g. centralus) — same Portal UX
KEDA scale rule	May be commented in Bicep until API accepts MI on custom scale rule — mention as roadmap

./scripts/deploy.shEvidence pack § deploytraining tag for clean story branch

Reference & labs

Install, deploy, live Azure POC diagram, troubleshooting, and reading — skip in live sessions unless needed.

Facilitators: jump here from overview (O) · Executives: optional

Deploy the ACA POC (optional lab)

export SQL_ADMIN_PASSWORD='...'
./scripts/deploy.sh <subscription-id> <resource-group> usgovvirginia
# Then: scripts/grant-sql-mi-access.sql

Local dev: in-memory store (no SQL connection string). ACA: Azure SQL via Managed Identity.

POC deployed on Azure — what we built

Portal resource diagram · RG referral-poc-dev · commercial Azure (GovCloud uses the same Bicep modules)

Azure Portal resource diagram: Container App referral-svc-dev in ACA environment with SQL, Service Bus, Key Vault, ACR, and Application Insights — Azure Portal → Resource group → Resource visualizer (live POC)

What we did

Referral Service on ACA

▸
Computereferral-svc-dev in referral-acaenv-dev · .NET 10 container
▸
DataAzure SQL referrals · MI auth (no SQL password in app)
▸
MessagingService Bus namespace · DAPR pub/sub on environment
▸
PlatformACR · Key Vault · App Insights + Log Analytics · user-assigned MI

Why

POC goals

1
Prove ACA defaultDAPR + Service Bus without AKS Helm tax
2
BMAD evidenceSame repo: artifacts + Bicep + story cycle
3
Teach from PortalRevisions, environment DAPR, MI wiring
4
Gov pathCommercial POC today → GovCloud with same topology

ACA wins

Blue/green & ops

B
Blue/greenMultiple revisions + traffic weights — no Flagger/Argo
D
DAPR on environmentComponent in ACA env, not in container image
K
KEDA / scaleService Bus scaler in Bicep — no cluster add-on
M
Managed opsPortal blades, integrated monitoring, MI to SQL/KV/ACR

See slides: Revisions · Blue/Green · Where is DAPR?docs/ACA-vs-AKS.mdinfra/main.bicep

Questions?

Where to go next

Try BMAD on a pilot project — one team, one sprint, one epic. The artifacts speak louder than this deck.
Run the cost calculator against your team size & rate — revisit slide 36 with real numbers.
Official docs — docs.bmad-method.org · bmadmethodguide.com
Community — BMAD-METHOD on GitHub · Discord (see official docs)
Getting-started narrative — Faulkner Medium article
Install command: npx bmad-method install --modules bmm --tools cursor,claude-code,github-copilot

Navigate: ← → · Fullscreen F · Overview grid O · Private notes popup S · Theme T